68

With ASP.NET Core now released, I was wondering what the best hosting option is for Linux and Mac environments. Is there any production grade web server under active development?

The only one I'm aware of is Kestrel that ships with the framework. From the docs, it appears that Kestrel is missing several features in comparison with IIS

enter image description here

This Stackoverflow answers suggests that .NET Core apps would work with any HTTP server. Does this mean it will work with say, Apache? Would it be missing any features if so? I was under the impression that it works only with OWIN based servers. Am I missing something?

Community
  • 1
  • 1
reggaemahn
  • 6,272
  • 6
  • 34
  • 59

1 Answers1

54

Use Kestrel, it's the way going forward. Refer to this: Change to IIS hosting model.

Does this mean it will work with say, Apache?

Yes and indeed that's the recommended approach. However, never expose Kestrel to outside world directly. Always put it behind a web server like nginx, IIS, HAProxy or Apache. More about Kestrel:

Some examples of using those reverse proxies:

tugberk
  • 57,477
  • 67
  • 243
  • 335
  • How does DotNetty correlate with Kestrel? Are they serve different niches? – Sergey Kostrukov Jun 06 '16 at 10:48
  • 10
    Why is it not recommended to expose Kestrel to the outside world? – Felix C Sep 21 '16 at 09:05
  • AFAIK, It still has problems and can get you into trouble in terms of perf wise and security point of view. However, I are skeptical about telling the details. Ask here to get more details from the security man behind ASP.NET: https://twitter.com/blowdart/status/704366493270564864 – tugberk Sep 26 '16 at 09:37
  • can't asp.net work directly with Apache without kestral ? – niceman Oct 29 '16 at 11:56
  • 18
    If you have to put Kestrel behind IIS, why introduce the additional complexity, why not just only use IIS? – The Muffin Man Nov 20 '16 at 00:14
  • Why is Apache the recommended approach over IIS? – Professor of programming Feb 01 '17 at 15:57
  • @Bonner who said that? – tugberk Feb 01 '17 at 16:07
  • 1
    @tugberk, sorry I missed that this relates to a *nix machine. – Professor of programming Feb 01 '17 at 17:52
  • 2
    From https://learn.microsoft.com/en-us/aspnet/core/fundamentals/servers/kestrel "A reverse proxy is required for edge deployments (exposed to traffic from the Internet) for security reasons. Kestrel is relatively new and does not yet have a full complement of defenses against attacks. This includes but isn't limited to appropriate timeouts, size limits, and concurrent connection limits." – Jacques Snyman May 18 '17 at 09:23